Welcome to edr-graph: Building an Autonomous, Graph-Powered SOC

[ticfinack]

Welcome to the edr-graph project.
I built this platform to solve a specific problem in the Endpoint Detection and Response (EDR) space: legacy agents block known signatures well, but they fail to provide temporal context for novel attacks, relying on human SOC analysts to stitch together disparate logs.

The Mission

edr-graph bridges the gap between hardware-speed deterministic enforcement and asynchronous, LLM-driven threat hunting. We do this by mapping OS-level telemetry (via eBPF on Linux and FSEvents on macOS) directly into an embedded Kùzu Graph Database on the endpoint.

Core Architectural Tenets

• O(1) Fast Path Enforcement: Known IOCs and blocked identity chains are killed in user-space/kernel-space in milliseconds before waking up the LLM.

• Deterministic Memory Governance: Graph databases are memory-hungry. We enforce strict cgroup resource constraints and active graph garbage collection to ensure the agent never crashes the host.

• Fail-Open Resilience: If the cloud LLM times out, the local agent degrades gracefully and maintains the local fast-path enforcement.

• Graph-Driven Context: We don't feed the LLM flat logs. We feed it temporal process/network chains so it can evaluate behaviors using the Diamond Model of Intrusion Analysis.

How to Contribute

I am actively looking for feedback, peer review, and pull requests—especially from experienced cybersecurity practitioners and systems engineers.

Whether you are writing eBPF hooks, optimizing Kùzu Cypher queries, or tuning the Gemma-3 prompts to catch LOLBins, drop your ideas in the discussions below. If you are proposing a major change, please focus on the trade-offs (e.g., CPU overhead vs. detection fidelity). Let's build something lethal.